Secure membranes and cross namespace communication

Abstract

Disclosed embodiments are related to information security and scripting-language technologies, and in particular, to technologies for providing secure membranes and cross namespace communication between isolated components in a scripting environment. Other embodiments may be described and/or claimed.

The invention claimed is: 
     
       1. One or more non-transitory computer-readable media (NTCRM) comprising instructions, wherein execution of the instructions is operable to cause a client computing system to:
 while loading a web application (app) including a plurality of components,
 identify a set of namespaces associated with the plurality of components, wherein each component of the plurality of components corresponds to at least one namespace of the set of namespaces, 
 create a set of membranes, wherein each secure membrane in the set of secure membranes is created for a corresponding namespace in the set of namespaces, each secure membrane includes a set of proxy objects, and each proxy object in the set of proxy objects has a corresponding target object outside of its secure membrane, and 
 execute individual components of the plurality of components within corresponding ones of the set of secure membranes to which the individual components belong. 
 
 
     
     
       2. The one or more NTCRM of  claim 1 , wherein, to create the secure membrane, execution of the instructions is operable to cause the client computing system to:
 generate an inline frame (iframe) for each identified namespace. 
 
     
     
       3. The one or more NTCRM of  claim 2 , wherein, to create the iframe for each identified namespace, execution of the instructions is operable to cause the client computing system to:
 generate a Hypertext Markup Language (HTML) document to include an iframe tag for each namespace. 
 
     
     
       4. The one or more NTCRM of  claim 1 , wherein, to create the secure membrane, execution of the instructions is operable to cause the client computing system to:
 create a realm object for each identified namespace. 
 
     
     
       5. The one or more NTCRM of  claim 1 , wherein each secure membrane comprises a sandboxed realm isolated from other realms and the set of proxy objects in each secure membrane accesses respective target objects outside of the sandboxed realm. 
     
     
       6. The one or more NTCRM of  claim 5 , wherein, to create the secure membrane, execution of the instructions is operable to cause the client computing system to:
 remap global references in the sandboxed realm to be the one or more proxy objects created in the sandboxed realm, wherein the remapping of the global references in the sandboxed realm includes replacement of function and object properties of global objects of the sandboxed realm with proxied counterparts, wherein the proxied counterparts have respective targets to global objects outside of the sandboxed realm. 
 
     
     
       7. The one or more NTCRM of  claim 1 , wherein a manifest file for the individual components defines the namespace of the individual components. 
     
     
       8. One or more non-transitory computer-readable media (NTCRM) comprising instructions, wherein execution of the instructions is operable to cause a client computing system to:
 while loading a web application (app) including a plurality of components,
 identify a namespace of individual components of the plurality of components, 
 create a secure membrane for each identified namespace, wherein the secure membrane comprises a sandboxed realm isolated from other realms and one or more proxy objects with respective targets outside of the sandboxed realm, and to create the secure membrane, execution of the instructions is operable to cause the client computing system to:
 remapping global references in the sandboxed realm to be the one or more proxy objects created in the sandboxed realm, wherein, to remap the global references, execution of the instructions is operable to cause the client computing system to: 
 replace function and object properties of global objects of the sandboxed realm with proxied counterparts, wherein the proxied counterparts have respective targets to global objects outside of the sandboxed realm; and 
 
 execute the individual components within a corresponding secure membrane created for a namespace to which the individual components belong. 
 
 
     
     
       9. The one or more NTCRM of  claim 8 , wherein the global objects of the sandboxed realm are respective secure globalThis objects, the global objects of outside of the sandboxed realm are respective raw globalThis objects, and execution of the instructions is operable to cause the client computing system to:
 remap property descriptors of the secure globalThis object to property descriptors of a raw globalThis object. 
 
     
     
       10. The one or more NTCRM of  claim 8 , wherein the sandboxed realm is a first sandboxed realm, and the global objects outside of the first sandboxed realm are global objects within a second sandboxed realm different than the first sandboxed realm. 
     
     
       11. The one or more NTCRM of  claim 10 , wherein execution of the instructions is operable to cause the client computing system to:
 operate a first component and a second component of a web application (app) within the first sandboxed realm and within the second sandboxed realm, respectively; 
 when script of the first component is to access the second component in the second sandboxed realm,
 generate a mirrored version of the second component for use in the first sandboxed realm by the first component, and 
 prevent access to the second component in the second sandboxed realm by the first component. 
 
 
     
     
       12. A client computing system comprising:
 a communication system to connect with a server computing system to establish a single page web application (SPA), the SPA including a plurality of components; 
 a memory system to store program code of a client app; and 
 a processor system communicatively coupled with the memory system and the communication system, the processor system is to operate the client app to: 
 while loading the SPA,
 identify a namespace of individual components of the plurality of components including a first namespace of a first component of the plurality of components and a second namespace of a second component of the plurality of components, 
 create a secure realm for each identified namespace including a first secure realm for the first namespace and a second secure realm for the second namespace; 
 
 execute the first component within the first secure realm; 
 execute the second component within the second secure realm isolated from the first secure realm; and 
 when the first component is to access the second component in the second secure realm,
 generate a mirrored version of the second component for use in the first secure realm by the first component, and 
 prevent access to the second component in the second secure realm by the first component. 
 
 
     
     
       13. The client computing system of  claim 12 , wherein, to generate the mirrored version of the second component, the processor system is to operate the client app to:
 import functionality of the second component into the first secure realm. 
 
     
     
       14. The client computing system of  claim 12 , wherein the processor system is to operate the client app to:
 operate the first component to extend an intrinsic element in a root realm via a secure proxy, the root realm being isolated from the first secure realm and the second secure realm. 
 
     
     
       15. The client computing system of  claim 14 , wherein the processor system is to operate the client app to:
 while loading the web app,
 identify a first namespace of the first component and a second namespace of the second component, and 
 create the first and second secure realms for the first and second identified namespaces, respectively. 
 
 
     
     
       16. The client computing system of  claim 15 , wherein, to create the first and second secure realms, the processor system is to operate the client app to:
 generate a first inline frame (iframe) within the web app for the first namespace; and 
 generate a second iframe within the web app for the second namespace. 
 
     
     
       17. The client computing system of  claim 16 , wherein, to create the first and second secure realms, the processor system is to operate the client app to:
 remap global references in the first secure realm to be one or more first proxy objects with respective targets in the root realm; and 
 remap global references in the second secure realm to be one or more second proxy objects with respective targets in the root realm. 
 
     
     
       18. The client computing system of  claim 14 , wherein the processor system is to operate the client app to:
 operate the first component to import the second component into the first secure realm via a secure proxy having a target in the root realm. 
 
     
     
       19. The client computing system of  claim 18 , wherein the processor system is to operate the client app to:
 operate the second component to export the second component to the first secure realm via a reverse proxy having a target in the root realm. 
 
     
     
       20. The client computing system of  claim 19 , wherein, to export the second component to the first secure realm, the processor system is to operate the client app to:
 operate the second component to extend a class definition in the first secure realm via the root realm. 
 
     
     
       21. The client computing system of  claim 12 , wherein the mirrored version of the second component is a secure proxy of a reverse proxy of the second component in the second secured realm. 
     
     
       22. The client computing system of  claim 12 , wherein a manifest file for the individual components defines the namespace of the individual components.